valguard-sdk 0.3.1__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- valguard_sdk-0.3.1/LICENSE +21 -0
- valguard_sdk-0.3.1/PKG-INFO +132 -0
- valguard_sdk-0.3.1/README.md +106 -0
- valguard_sdk-0.3.1/pyproject.toml +39 -0
- valguard_sdk-0.3.1/setup.cfg +4 -0
- valguard_sdk-0.3.1/tests/test_evidence.py +28 -0
- valguard_sdk-0.3.1/tests/test_headers.py +134 -0
- valguard_sdk-0.3.1/tests/test_internal.py +26 -0
- valguard_sdk-0.3.1/tests/test_playbook.py +33 -0
- valguard_sdk-0.3.1/tests/test_webhook.py +25 -0
- valguard_sdk-0.3.1/valguard/__init__.py +52 -0
- valguard_sdk-0.3.1/valguard/client.py +298 -0
- valguard_sdk-0.3.1/valguard/constants.py +4 -0
- valguard_sdk-0.3.1/valguard/errors.py +55 -0
- valguard_sdk-0.3.1/valguard/evidence.py +49 -0
- valguard_sdk-0.3.1/valguard/headers.py +119 -0
- valguard_sdk-0.3.1/valguard/webhook.py +56 -0
- valguard_sdk-0.3.1/valguard_sdk.egg-info/PKG-INFO +132 -0
- valguard_sdk-0.3.1/valguard_sdk.egg-info/SOURCES.txt +20 -0
- valguard_sdk-0.3.1/valguard_sdk.egg-info/dependency_links.txt +1 -0
- valguard_sdk-0.3.1/valguard_sdk.egg-info/requires.txt +3 -0
- valguard_sdk-0.3.1/valguard_sdk.egg-info/top_level.txt +1 -0
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 ValGuard
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
|
@@ -0,0 +1,132 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: valguard-sdk
|
|
3
|
+
Version: 0.3.1
|
|
4
|
+
Summary: OpenAI-compatible client helpers for the ValGuard integrity layer
|
|
5
|
+
Author: ValGuard
|
|
6
|
+
License: MIT
|
|
7
|
+
Project-URL: Homepage, https://valguard.ai
|
|
8
|
+
Project-URL: Documentation, https://valguard.ai/docs/quickstart
|
|
9
|
+
Project-URL: Repository, https://github.com/valguard-ai/sdk-python
|
|
10
|
+
Project-URL: Source, https://github.com/valguard-ai/sdk-python
|
|
11
|
+
Keywords: llm,openai,validation,guardrails,valguard
|
|
12
|
+
Classifier: Development Status :: 3 - Alpha
|
|
13
|
+
Classifier: Intended Audience :: Developers
|
|
14
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
15
|
+
Classifier: Programming Language :: Python :: 3
|
|
16
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
17
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
18
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
19
|
+
Classifier: Topic :: Software Development :: Libraries
|
|
20
|
+
Requires-Python: >=3.10
|
|
21
|
+
Description-Content-Type: text/markdown
|
|
22
|
+
License-File: LICENSE
|
|
23
|
+
Provides-Extra: openai
|
|
24
|
+
Requires-Dist: openai>=1.0.0; extra == "openai"
|
|
25
|
+
Dynamic: license-file
|
|
26
|
+
|
|
27
|
+
# valguard-sdk (Python)
|
|
28
|
+
|
|
29
|
+
Thin Python helpers for the ValGuard OpenAI-compatible integrity layer.
|
|
30
|
+
|
|
31
|
+
**Package name: `valguard-sdk`.** `pip install valguard` installs an unrelated third-party project. Import this SDK as `valguard`.
|
|
32
|
+
|
|
33
|
+
Public GitHub: [github.com/valguard-ai/sdk-python](https://github.com/valguard-ai/sdk-python).
|
|
34
|
+
|
|
35
|
+
Set `VG_PROXY` to your layer URL — see [valguard.ai/docs/quickstart](https://valguard.ai/docs/quickstart).
|
|
36
|
+
|
|
37
|
+
## Install
|
|
38
|
+
|
|
39
|
+
```bash
|
|
40
|
+
pip install valguard-sdk
|
|
41
|
+
# or, from this repo: pip install "git+https://github.com/valguard-ai/sdk-python.git"
|
|
42
|
+
pip install openai # optional, for OpenAI SDK bridge
|
|
43
|
+
```
|
|
44
|
+
|
|
45
|
+
## Environment
|
|
46
|
+
|
|
47
|
+
```bash
|
|
48
|
+
export VG_PROXY="https://api.valguard.ai" # your layer base URL
|
|
49
|
+
export VG_API_KEY="vg_live_..."
|
|
50
|
+
export VG_AGENT="invoice_extraction_agent"
|
|
51
|
+
export VG_PROVIDER_KEY="sk-..." # optional BYOK upstream key
|
|
52
|
+
```
|
|
53
|
+
|
|
54
|
+
## with_agent and with_playbook
|
|
55
|
+
|
|
56
|
+
`with_agent` sets `X-VG-Agent`. `with_playbook` sets `X-VG-Flow`. Pass `provider_key` (or `VG_PROVIDER_KEY` via `from_env`) so `openai_client_kwargs()` includes `X-Provider-Key`.
|
|
57
|
+
|
|
58
|
+
```python
|
|
59
|
+
vg = ValGuardClient.from_env().with_playbook("invoice-processing")
|
|
60
|
+
```
|
|
61
|
+
|
|
62
|
+
## OpenAI SDK (recommended)
|
|
63
|
+
|
|
64
|
+
```python
|
|
65
|
+
from openai import OpenAI
|
|
66
|
+
from valguard import ValGuardClient
|
|
67
|
+
|
|
68
|
+
vg = ValGuardClient.from_env()
|
|
69
|
+
client = OpenAI(**vg.openai_client_kwargs())
|
|
70
|
+
|
|
71
|
+
raw = client.with_raw_response.chat.completions.create(
|
|
72
|
+
model="openai/gpt-4o-mini",
|
|
73
|
+
messages=[{"role": "user", "content": "Extract invoice JSON"}],
|
|
74
|
+
)
|
|
75
|
+
|
|
76
|
+
print(vg.parse_response_headers(dict(raw.http_response.headers)))
|
|
77
|
+
print(raw.parse())
|
|
78
|
+
```
|
|
79
|
+
|
|
80
|
+
## Stdlib-only HTTP
|
|
81
|
+
|
|
82
|
+
```python
|
|
83
|
+
from valguard import ValGuardClient
|
|
84
|
+
|
|
85
|
+
vg = ValGuardClient(
|
|
86
|
+
api_key="vg_live_...",
|
|
87
|
+
base_url="https://api.valguard.ai",
|
|
88
|
+
agent_slug="default",
|
|
89
|
+
provider_key="sk-...",
|
|
90
|
+
)
|
|
91
|
+
|
|
92
|
+
result = vg.chat_completions(
|
|
93
|
+
model="openai/gpt-4o-mini",
|
|
94
|
+
messages=[{"role": "user", "content": "hi"}],
|
|
95
|
+
)
|
|
96
|
+
print(result.validation)
|
|
97
|
+
print(result.data)
|
|
98
|
+
```
|
|
99
|
+
|
|
100
|
+
## RAG sources
|
|
101
|
+
|
|
102
|
+
```python
|
|
103
|
+
vg = ValGuardClient.from_env().with_rag_sources(
|
|
104
|
+
[{"id": "doc-1", "text": "Acme revenue was $4.2M in Q3."}]
|
|
105
|
+
)
|
|
106
|
+
```
|
|
107
|
+
|
|
108
|
+
## Errors
|
|
109
|
+
|
|
110
|
+
```python
|
|
111
|
+
from valguard import ValGuardClient, ValGuardError
|
|
112
|
+
|
|
113
|
+
try:
|
|
114
|
+
vg.chat_completions(model="openai/gpt-4o-mini", messages=[])
|
|
115
|
+
except ValGuardError as err:
|
|
116
|
+
print(err.info.type) # validation_block, input_validation, rate_limit_exceeded, ...
|
|
117
|
+
```
|
|
118
|
+
|
|
119
|
+
Soft-fail agents return HTTP 200 with `valid: false` — inspect `result.error.soft_fail` instead of exceptions.
|
|
120
|
+
|
|
121
|
+
## API surface
|
|
122
|
+
|
|
123
|
+
| Symbol | Purpose |
|
|
124
|
+
|--------|---------|
|
|
125
|
+
| `ValGuardClient` | Main client + `from_env()` |
|
|
126
|
+
| `openai_client_kwargs()` | Legacy functional helper |
|
|
127
|
+
| `parse_validation_headers()` | Read `X-VG-*` headers, including repair, cache, trace, and approval |
|
|
128
|
+
| `verify_proof()` / `verify_evidence()` | Offline HMAC check of a Proof download (`valguard-evidence/1`) |
|
|
129
|
+
| `parse_valguard_error()` | Parse error / soft-fail JSON |
|
|
130
|
+
| `ValGuardError` | Raised on non-2xx responses |
|
|
131
|
+
|
|
132
|
+
`with_approval_mode("async")` sends `X-VG-Approval-Mode`. `with_idempotency_key` sends `X-VG-Idempotency-Key`. `with_trace` sends `traceparent`, `X-VG-Parent-Span-Id`, and `X-VG-Agent-Id`. Response repair is reported with `X-VG-Healed`, `X-VG-Healed-Rules`, `X-VG-Healed-Event-Count`, and `X-VG-Healed-Trace`. Presets are agent settings.
|
|
@@ -0,0 +1,106 @@
|
|
|
1
|
+
# valguard-sdk (Python)
|
|
2
|
+
|
|
3
|
+
Thin Python helpers for the ValGuard OpenAI-compatible integrity layer.
|
|
4
|
+
|
|
5
|
+
**Package name: `valguard-sdk`.** `pip install valguard` installs an unrelated third-party project. Import this SDK as `valguard`.
|
|
6
|
+
|
|
7
|
+
Public GitHub: [github.com/valguard-ai/sdk-python](https://github.com/valguard-ai/sdk-python).
|
|
8
|
+
|
|
9
|
+
Set `VG_PROXY` to your layer URL — see [valguard.ai/docs/quickstart](https://valguard.ai/docs/quickstart).
|
|
10
|
+
|
|
11
|
+
## Install
|
|
12
|
+
|
|
13
|
+
```bash
|
|
14
|
+
pip install valguard-sdk
|
|
15
|
+
# or, from this repo: pip install "git+https://github.com/valguard-ai/sdk-python.git"
|
|
16
|
+
pip install openai # optional, for OpenAI SDK bridge
|
|
17
|
+
```
|
|
18
|
+
|
|
19
|
+
## Environment
|
|
20
|
+
|
|
21
|
+
```bash
|
|
22
|
+
export VG_PROXY="https://api.valguard.ai" # your layer base URL
|
|
23
|
+
export VG_API_KEY="vg_live_..."
|
|
24
|
+
export VG_AGENT="invoice_extraction_agent"
|
|
25
|
+
export VG_PROVIDER_KEY="sk-..." # optional BYOK upstream key
|
|
26
|
+
```
|
|
27
|
+
|
|
28
|
+
## with_agent and with_playbook
|
|
29
|
+
|
|
30
|
+
`with_agent` sets `X-VG-Agent`. `with_playbook` sets `X-VG-Flow`. Pass `provider_key` (or `VG_PROVIDER_KEY` via `from_env`) so `openai_client_kwargs()` includes `X-Provider-Key`.
|
|
31
|
+
|
|
32
|
+
```python
|
|
33
|
+
vg = ValGuardClient.from_env().with_playbook("invoice-processing")
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
## OpenAI SDK (recommended)
|
|
37
|
+
|
|
38
|
+
```python
|
|
39
|
+
from openai import OpenAI
|
|
40
|
+
from valguard import ValGuardClient
|
|
41
|
+
|
|
42
|
+
vg = ValGuardClient.from_env()
|
|
43
|
+
client = OpenAI(**vg.openai_client_kwargs())
|
|
44
|
+
|
|
45
|
+
raw = client.with_raw_response.chat.completions.create(
|
|
46
|
+
model="openai/gpt-4o-mini",
|
|
47
|
+
messages=[{"role": "user", "content": "Extract invoice JSON"}],
|
|
48
|
+
)
|
|
49
|
+
|
|
50
|
+
print(vg.parse_response_headers(dict(raw.http_response.headers)))
|
|
51
|
+
print(raw.parse())
|
|
52
|
+
```
|
|
53
|
+
|
|
54
|
+
## Stdlib-only HTTP
|
|
55
|
+
|
|
56
|
+
```python
|
|
57
|
+
from valguard import ValGuardClient
|
|
58
|
+
|
|
59
|
+
vg = ValGuardClient(
|
|
60
|
+
api_key="vg_live_...",
|
|
61
|
+
base_url="https://api.valguard.ai",
|
|
62
|
+
agent_slug="default",
|
|
63
|
+
provider_key="sk-...",
|
|
64
|
+
)
|
|
65
|
+
|
|
66
|
+
result = vg.chat_completions(
|
|
67
|
+
model="openai/gpt-4o-mini",
|
|
68
|
+
messages=[{"role": "user", "content": "hi"}],
|
|
69
|
+
)
|
|
70
|
+
print(result.validation)
|
|
71
|
+
print(result.data)
|
|
72
|
+
```
|
|
73
|
+
|
|
74
|
+
## RAG sources
|
|
75
|
+
|
|
76
|
+
```python
|
|
77
|
+
vg = ValGuardClient.from_env().with_rag_sources(
|
|
78
|
+
[{"id": "doc-1", "text": "Acme revenue was $4.2M in Q3."}]
|
|
79
|
+
)
|
|
80
|
+
```
|
|
81
|
+
|
|
82
|
+
## Errors
|
|
83
|
+
|
|
84
|
+
```python
|
|
85
|
+
from valguard import ValGuardClient, ValGuardError
|
|
86
|
+
|
|
87
|
+
try:
|
|
88
|
+
vg.chat_completions(model="openai/gpt-4o-mini", messages=[])
|
|
89
|
+
except ValGuardError as err:
|
|
90
|
+
print(err.info.type) # validation_block, input_validation, rate_limit_exceeded, ...
|
|
91
|
+
```
|
|
92
|
+
|
|
93
|
+
Soft-fail agents return HTTP 200 with `valid: false` — inspect `result.error.soft_fail` instead of exceptions.
|
|
94
|
+
|
|
95
|
+
## API surface
|
|
96
|
+
|
|
97
|
+
| Symbol | Purpose |
|
|
98
|
+
|--------|---------|
|
|
99
|
+
| `ValGuardClient` | Main client + `from_env()` |
|
|
100
|
+
| `openai_client_kwargs()` | Legacy functional helper |
|
|
101
|
+
| `parse_validation_headers()` | Read `X-VG-*` headers, including repair, cache, trace, and approval |
|
|
102
|
+
| `verify_proof()` / `verify_evidence()` | Offline HMAC check of a Proof download (`valguard-evidence/1`) |
|
|
103
|
+
| `parse_valguard_error()` | Parse error / soft-fail JSON |
|
|
104
|
+
| `ValGuardError` | Raised on non-2xx responses |
|
|
105
|
+
|
|
106
|
+
`with_approval_mode("async")` sends `X-VG-Approval-Mode`. `with_idempotency_key` sends `X-VG-Idempotency-Key`. `with_trace` sends `traceparent`, `X-VG-Parent-Span-Id`, and `X-VG-Agent-Id`. Response repair is reported with `X-VG-Healed`, `X-VG-Healed-Rules`, `X-VG-Healed-Event-Count`, and `X-VG-Healed-Trace`. Presets are agent settings.
|
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
[build-system]
|
|
2
|
+
requires = ["setuptools>=68"]
|
|
3
|
+
build-backend = "setuptools.build_meta"
|
|
4
|
+
|
|
5
|
+
[project]
|
|
6
|
+
# Distribution name. `pip install valguard` is an unrelated third-party package.
|
|
7
|
+
# Install this SDK as `valguard-sdk`. The import package remains `valguard`.
|
|
8
|
+
name = "valguard-sdk"
|
|
9
|
+
version = "0.3.1"
|
|
10
|
+
description = "OpenAI-compatible client helpers for the ValGuard integrity layer"
|
|
11
|
+
readme = "README.md"
|
|
12
|
+
requires-python = ">=3.10"
|
|
13
|
+
license = { text = "MIT" }
|
|
14
|
+
authors = [{ name = "ValGuard" }]
|
|
15
|
+
keywords = ["llm", "openai", "validation", "guardrails", "valguard"]
|
|
16
|
+
classifiers = [
|
|
17
|
+
"Development Status :: 3 - Alpha",
|
|
18
|
+
"Intended Audience :: Developers",
|
|
19
|
+
"License :: OSI Approved :: MIT License",
|
|
20
|
+
"Programming Language :: Python :: 3",
|
|
21
|
+
"Programming Language :: Python :: 3.10",
|
|
22
|
+
"Programming Language :: Python :: 3.11",
|
|
23
|
+
"Programming Language :: Python :: 3.12",
|
|
24
|
+
"Topic :: Software Development :: Libraries",
|
|
25
|
+
]
|
|
26
|
+
dependencies = []
|
|
27
|
+
|
|
28
|
+
[project.optional-dependencies]
|
|
29
|
+
openai = ["openai>=1.0.0"]
|
|
30
|
+
|
|
31
|
+
[project.urls]
|
|
32
|
+
Homepage = "https://valguard.ai"
|
|
33
|
+
Documentation = "https://valguard.ai/docs/quickstart"
|
|
34
|
+
Repository = "https://github.com/valguard-ai/sdk-python"
|
|
35
|
+
Source = "https://github.com/valguard-ai/sdk-python"
|
|
36
|
+
|
|
37
|
+
[tool.setuptools.packages.find]
|
|
38
|
+
where = ["."]
|
|
39
|
+
include = ["valguard*"]
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
from valguard.evidence import EVIDENCE_TYP, verify_evidence, verify_proof
|
|
2
|
+
|
|
3
|
+
SECRET = "contract-test-evidence-secret"
|
|
4
|
+
KEY_ID = "org:bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb:v1"
|
|
5
|
+
PAYLOAD = (
|
|
6
|
+
'{"typ":"valguard-evidence/1","request_id":"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",'
|
|
7
|
+
'"org_id":"bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb","checked_at":"2026-03-15T08:30:00Z",'
|
|
8
|
+
'"engine_version":"valguard-engine/1","policy_snapshot_hash":"policy-1",'
|
|
9
|
+
'"request_digest":"sha256:758d61f26a44448384e5c4468a0dcb7a2abe456067b0f7b505bc28b9411fe931",'
|
|
10
|
+
'"response_digest":"sha256:9795c5ff8937f23526ccb207a5684c1fc94a7854e19c021b39d944e51f5baef2",'
|
|
11
|
+
'"verdicts":[]}'
|
|
12
|
+
)
|
|
13
|
+
SIGNATURE = "sha256=35b87328b2f2c94b34658646f15e993fe900e1a79fe75558b4b6140d55b3003a"
|
|
14
|
+
|
|
15
|
+
|
|
16
|
+
def test_verify_evidence_contract_vector() -> None:
|
|
17
|
+
assert EVIDENCE_TYP == "valguard-evidence/1"
|
|
18
|
+
assert verify_evidence(KEY_ID, PAYLOAD, SIGNATURE, SECRET) is True
|
|
19
|
+
assert verify_evidence(KEY_ID, PAYLOAD, SIGNATURE + "x", SECRET) is False
|
|
20
|
+
assert verify_evidence(KEY_ID, PAYLOAD[:-1] + "x", SIGNATURE, SECRET) is False
|
|
21
|
+
assert verify_evidence(KEY_ID, PAYLOAD, SIGNATURE, "") is False
|
|
22
|
+
|
|
23
|
+
|
|
24
|
+
def test_verify_proof_json_and_mapping() -> None:
|
|
25
|
+
record = {"key_id": KEY_ID, "payload": PAYLOAD, "signature": SIGNATURE}
|
|
26
|
+
assert verify_proof(record, SECRET) is True
|
|
27
|
+
assert verify_proof('{"key_id":"x"}', SECRET) is False
|
|
28
|
+
assert verify_proof("{", SECRET) is False
|
|
@@ -0,0 +1,134 @@
|
|
|
1
|
+
from valguard.errors import parse_valguard_error
|
|
2
|
+
from valguard.headers import parse_validation_headers
|
|
3
|
+
|
|
4
|
+
|
|
5
|
+
def test_parse_validation_headers() -> None:
|
|
6
|
+
parsed = parse_validation_headers(
|
|
7
|
+
{
|
|
8
|
+
"X-VG-Validation-Status": "shadow",
|
|
9
|
+
"X-VG-Shadow-Mode": "true",
|
|
10
|
+
"X-VG-Latency-ms": "12",
|
|
11
|
+
"X-VG-Request-Id": "abc-123",
|
|
12
|
+
}
|
|
13
|
+
)
|
|
14
|
+
assert parsed.validation_status == "shadow"
|
|
15
|
+
assert parsed.shadow_mode is True
|
|
16
|
+
assert parsed.latency_ms == 12
|
|
17
|
+
assert parsed.request_id == "abc-123"
|
|
18
|
+
|
|
19
|
+
|
|
20
|
+
def test_parse_orchestration_headers() -> None:
|
|
21
|
+
parsed = parse_validation_headers(
|
|
22
|
+
{
|
|
23
|
+
"X-VG-Target-Type": "playbook",
|
|
24
|
+
"X-VG-Orchestration-Path": "a,b,c",
|
|
25
|
+
"X-VG-Orchestration-Validations-Used": "5",
|
|
26
|
+
"X-VG-Requests-Remaining": "unlimited",
|
|
27
|
+
"X-VG-Idempotency-Replayed": "true",
|
|
28
|
+
}
|
|
29
|
+
)
|
|
30
|
+
assert parsed.target_type == "playbook"
|
|
31
|
+
assert parsed.orchestration_path == "a,b,c"
|
|
32
|
+
assert parsed.orchestration_validations_used == 5
|
|
33
|
+
assert parsed.orchestration_executions_remaining == "unlimited"
|
|
34
|
+
assert parsed.idempotency_replayed is True
|
|
35
|
+
|
|
36
|
+
|
|
37
|
+
def test_parse_repair_trace_and_run_headers() -> None:
|
|
38
|
+
parsed = parse_validation_headers(
|
|
39
|
+
{
|
|
40
|
+
"X-VG-Validation-Status": "stream_passthrough",
|
|
41
|
+
"X-VG-Healed": "true",
|
|
42
|
+
"X-VG-Healed-Rules": "tier1:trim_whitespace,tier2:enum_normalize",
|
|
43
|
+
"X-VG-Healed-Event-Count": "2",
|
|
44
|
+
"X-VG-Healed-Trace": "tier1:trim_whitespace@_,tier2:enum_normalize@status",
|
|
45
|
+
"X-VG-Cache": "cache_hit",
|
|
46
|
+
"X-Trace-Id": "trace-1",
|
|
47
|
+
"X-VG-Span-Id": "span-1",
|
|
48
|
+
"X-VG-Parent-Span-Id": "parent-1",
|
|
49
|
+
"X-VG-Agent-Id": "billing-agent",
|
|
50
|
+
"X-VG-Run-Id": "run-1",
|
|
51
|
+
"X-VG-Run-Status": "waiting_approval",
|
|
52
|
+
"X-VG-Approval-Id": "appr-1",
|
|
53
|
+
"X-VG-License-Status": "valid",
|
|
54
|
+
"X-VG-License-Mode": "enforce",
|
|
55
|
+
}
|
|
56
|
+
)
|
|
57
|
+
assert parsed.validation_status == "stream_passthrough"
|
|
58
|
+
assert parsed.healed is True
|
|
59
|
+
assert parsed.healed_rules == ("tier1:trim_whitespace", "tier2:enum_normalize")
|
|
60
|
+
assert parsed.healed_event_count == 2
|
|
61
|
+
assert parsed.healed_trace == ("tier1:trim_whitespace@_", "tier2:enum_normalize@status")
|
|
62
|
+
assert parsed.cache_status == "cache_hit"
|
|
63
|
+
assert parsed.trace_id == "trace-1"
|
|
64
|
+
assert parsed.span_id == "span-1"
|
|
65
|
+
assert parsed.parent_span_id == "parent-1"
|
|
66
|
+
assert parsed.agent_id == "billing-agent"
|
|
67
|
+
assert parsed.run_id == "run-1"
|
|
68
|
+
assert parsed.run_status == "waiting_approval"
|
|
69
|
+
assert parsed.approval_id == "appr-1"
|
|
70
|
+
assert parsed.license_status == "valid"
|
|
71
|
+
assert parsed.license_mode == "enforce"
|
|
72
|
+
|
|
73
|
+
|
|
74
|
+
def test_unknown_validation_status_is_dropped() -> None:
|
|
75
|
+
parsed = parse_validation_headers({"X-VG-Validation-Status": "reasked_ok"})
|
|
76
|
+
assert parsed.validation_status is None
|
|
77
|
+
|
|
78
|
+
|
|
79
|
+
def test_request_headers_for_approval_and_trace() -> None:
|
|
80
|
+
from valguard.client import ValGuardClient
|
|
81
|
+
|
|
82
|
+
client = ValGuardClient(
|
|
83
|
+
api_key="vg_test",
|
|
84
|
+
base_url="https://api.example.com",
|
|
85
|
+
agent_slug="",
|
|
86
|
+
flow_slug="invoice-processing",
|
|
87
|
+
provider_key="sk-up",
|
|
88
|
+
).with_idempotency_key("idem-1").with_approval_mode("async").with_trace(
|
|
89
|
+
traceparent="00-abc-def-01",
|
|
90
|
+
parent_span_id="parent",
|
|
91
|
+
agent_id="billing-agent",
|
|
92
|
+
)
|
|
93
|
+
headers = client.build_headers()
|
|
94
|
+
assert headers["X-VG-Flow"] == "invoice-processing"
|
|
95
|
+
assert "X-VG-Agent" not in headers
|
|
96
|
+
assert headers["X-VG-Idempotency-Key"] == "idem-1"
|
|
97
|
+
assert headers["X-VG-Approval-Mode"] == "async"
|
|
98
|
+
assert headers["traceparent"] == "00-abc-def-01"
|
|
99
|
+
assert headers["X-VG-Parent-Span-Id"] == "parent"
|
|
100
|
+
assert headers["X-VG-Agent-Id"] == "billing-agent"
|
|
101
|
+
assert headers["X-Provider-Key"] == "sk-up"
|
|
102
|
+
openai = client.openai_client_kwargs()
|
|
103
|
+
assert "Authorization" not in openai["default_headers"]
|
|
104
|
+
assert openai["default_headers"]["X-VG-Approval-Mode"] == "async"
|
|
105
|
+
assert openai["default_headers"]["X-Provider-Key"] == "sk-up"
|
|
106
|
+
|
|
107
|
+
|
|
108
|
+
def test_parse_soft_fail() -> None:
|
|
109
|
+
info = parse_valguard_error(
|
|
110
|
+
200,
|
|
111
|
+
{"valid": False, "validation": {"status": "block", "failures": []}},
|
|
112
|
+
)
|
|
113
|
+
assert info is not None
|
|
114
|
+
assert info.soft_fail is True
|
|
115
|
+
|
|
116
|
+
|
|
117
|
+
def test_parse_validation_block() -> None:
|
|
118
|
+
info = parse_valguard_error(
|
|
119
|
+
403,
|
|
120
|
+
{"error": {"type": "validation_block", "reason": "required_fields", "message": "blocked"}},
|
|
121
|
+
)
|
|
122
|
+
assert info is not None
|
|
123
|
+
assert info.type == "validation_block"
|
|
124
|
+
|
|
125
|
+
|
|
126
|
+
if __name__ == "__main__":
|
|
127
|
+
test_parse_validation_headers()
|
|
128
|
+
test_parse_orchestration_headers()
|
|
129
|
+
test_parse_repair_trace_and_run_headers()
|
|
130
|
+
test_unknown_validation_status_is_dropped()
|
|
131
|
+
test_request_headers_for_approval_and_trace()
|
|
132
|
+
test_parse_soft_fail()
|
|
133
|
+
test_parse_validation_block()
|
|
134
|
+
print("sdk-python tests: ok")
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
from valguard.client import ValGuardClient
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
def test_build_internal_test_headers_api_key() -> None:
|
|
5
|
+
client = ValGuardClient(api_key="vg_test", base_url="https://api.example.com")
|
|
6
|
+
headers = client._build_internal_test_headers()
|
|
7
|
+
assert headers["Authorization"] == "Bearer vg_test"
|
|
8
|
+
|
|
9
|
+
|
|
10
|
+
def test_build_internal_test_headers_secret() -> None:
|
|
11
|
+
client = ValGuardClient(
|
|
12
|
+
api_key="",
|
|
13
|
+
base_url="https://api.example.com",
|
|
14
|
+
internal_secret="secret",
|
|
15
|
+
project_id="proj-1",
|
|
16
|
+
)
|
|
17
|
+
headers = client._build_internal_test_headers()
|
|
18
|
+
assert headers["X-VG-Internal-Secret"] == "secret"
|
|
19
|
+
assert headers["X-VG-Project-Id"] == "proj-1"
|
|
20
|
+
assert "Authorization" not in headers
|
|
21
|
+
|
|
22
|
+
|
|
23
|
+
if __name__ == "__main__":
|
|
24
|
+
test_build_internal_test_headers_api_key()
|
|
25
|
+
test_build_internal_test_headers_secret()
|
|
26
|
+
print("test_internal: ok")
|
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
from valguard.client import ValGuardClient
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
def test_with_playbook_headers() -> None:
|
|
5
|
+
client = ValGuardClient(
|
|
6
|
+
api_key="vg_test",
|
|
7
|
+
base_url="https://api.example.com",
|
|
8
|
+
agent_slug="",
|
|
9
|
+
flow_slug="invoice-processing",
|
|
10
|
+
)
|
|
11
|
+
headers = client.build_headers()
|
|
12
|
+
assert headers["X-VG-Flow"] == "invoice-processing"
|
|
13
|
+
assert "X-VG-Agent" not in headers
|
|
14
|
+
|
|
15
|
+
|
|
16
|
+
def test_mutually_exclusive_headers() -> None:
|
|
17
|
+
client = ValGuardClient(
|
|
18
|
+
api_key="vg_test",
|
|
19
|
+
base_url="https://api.example.com",
|
|
20
|
+
agent_slug="a",
|
|
21
|
+
flow_slug="f",
|
|
22
|
+
)
|
|
23
|
+
try:
|
|
24
|
+
client.build_headers()
|
|
25
|
+
raise AssertionError("expected ValueError")
|
|
26
|
+
except ValueError as e:
|
|
27
|
+
assert "mutually_exclusive_headers" in str(e)
|
|
28
|
+
|
|
29
|
+
|
|
30
|
+
if __name__ == "__main__":
|
|
31
|
+
test_with_playbook_headers()
|
|
32
|
+
test_mutually_exclusive_headers()
|
|
33
|
+
print("test_playbook: ok")
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
from valguard.webhook import (
|
|
2
|
+
WEBHOOK_SIGNATURE_HEADER,
|
|
3
|
+
sign_webhook_payload,
|
|
4
|
+
verify_webhook_signature,
|
|
5
|
+
)
|
|
6
|
+
|
|
7
|
+
CONTRACT_SECRET = "contract-test-webhook-secret"
|
|
8
|
+
CONTRACT_BODY = b'{"event":"validation.block","request_id":"abc"}'
|
|
9
|
+
CONTRACT_SIG = sign_webhook_payload(CONTRACT_BODY, CONTRACT_SECRET, 1700000000)
|
|
10
|
+
|
|
11
|
+
|
|
12
|
+
def test_webhook_signature_contract() -> None:
|
|
13
|
+
assert WEBHOOK_SIGNATURE_HEADER == "X-VG-Signature"
|
|
14
|
+
assert CONTRACT_SIG.startswith("t=1700000000,v1=")
|
|
15
|
+
assert verify_webhook_signature(CONTRACT_BODY, CONTRACT_SIG, CONTRACT_SECRET, max_age_seconds=None) is True
|
|
16
|
+
assert verify_webhook_signature(CONTRACT_BODY.decode(), CONTRACT_SIG, CONTRACT_SECRET, max_age_seconds=None) is True
|
|
17
|
+
assert verify_webhook_signature(CONTRACT_BODY, "sha256=bad", CONTRACT_SECRET) is False
|
|
18
|
+
assert verify_webhook_signature(CONTRACT_BODY, CONTRACT_SIG, "") is False
|
|
19
|
+
fresh = sign_webhook_payload("hello", CONTRACT_SECRET)
|
|
20
|
+
assert verify_webhook_signature("hello", fresh, CONTRACT_SECRET) is True
|
|
21
|
+
|
|
22
|
+
|
|
23
|
+
if __name__ == "__main__":
|
|
24
|
+
test_webhook_signature_contract()
|
|
25
|
+
print("test_webhook: ok")
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
"""ValGuard integration helpers for the OpenAI-compatible layer."""
|
|
2
|
+
|
|
3
|
+
from valguard.client import ChatCompletionResult, TestValidatorsResult, ValGuardClient
|
|
4
|
+
from valguard.errors import ValGuardError, ValGuardErrorInfo, parse_valguard_error
|
|
5
|
+
from valguard.evidence import EVIDENCE_TYP, verify_evidence, verify_proof
|
|
6
|
+
from valguard.headers import ValidationHeaders, parse_validation_headers
|
|
7
|
+
from valguard.webhook import (
|
|
8
|
+
WEBHOOK_SIGNATURE_HEADER,
|
|
9
|
+
sign_webhook_payload,
|
|
10
|
+
verify_webhook_signature,
|
|
11
|
+
)
|
|
12
|
+
|
|
13
|
+
|
|
14
|
+
def openai_client_kwargs(
|
|
15
|
+
api_key: str,
|
|
16
|
+
base_url: str,
|
|
17
|
+
agent_slug: str,
|
|
18
|
+
provider_key: str | None = None,
|
|
19
|
+
) -> dict:
|
|
20
|
+
"""Backward-compatible helper — prefer ValGuardClient.openai_client_kwargs().
|
|
21
|
+
|
|
22
|
+
Pass provider_key so the OpenAI client sends X-Provider-Key (BYOK).
|
|
23
|
+
"""
|
|
24
|
+
return ValGuardClient(
|
|
25
|
+
api_key=api_key,
|
|
26
|
+
base_url=base_url,
|
|
27
|
+
agent_slug=agent_slug,
|
|
28
|
+
provider_key=provider_key,
|
|
29
|
+
).openai_client_kwargs()
|
|
30
|
+
|
|
31
|
+
|
|
32
|
+
__all__ = [
|
|
33
|
+
"ChatCompletionResult",
|
|
34
|
+
"EVIDENCE_TYP",
|
|
35
|
+
"TestValidatorsResult",
|
|
36
|
+
"ValGuardClient",
|
|
37
|
+
"ValGuardError",
|
|
38
|
+
"ValGuardErrorInfo",
|
|
39
|
+
"ValidationHeaders",
|
|
40
|
+
"WEBHOOK_SIGNATURE_HEADER",
|
|
41
|
+
"openai_client_kwargs",
|
|
42
|
+
"parse_response_headers",
|
|
43
|
+
"parse_valguard_error",
|
|
44
|
+
"parse_validation_headers",
|
|
45
|
+
"sign_webhook_payload",
|
|
46
|
+
"verify_evidence",
|
|
47
|
+
"verify_proof",
|
|
48
|
+
"verify_webhook_signature",
|
|
49
|
+
]
|
|
50
|
+
|
|
51
|
+
# Alias for symmetry with the Node SDK
|
|
52
|
+
parse_response_headers = parse_validation_headers
|